# Is your company ready for Gemini Enterprise? The five things we check before switching it on

Published: 2026-10-29  
Author: Guanacos Tech (https://guanacostech.com)  
Canonical: https://guanacostech.com/blog/gemini-enterprise-readiness-small-business

> Check your Drive sharing, agent access, data protection rules and seat plan before an AI assistant starts reading everything your staff can already read.

**Short answer:** For a small business, Gemini Enterprise is a separate paid license rather than part of a Workspace plan, and it reads only what each user can already open in Drive, Gmail and Calendar. The real work is cleaning up over-broad file sharing first, then turning the service on for one pilot group instead of the whole domain.

Say a 30-person firm buys Gemini Enterprise licenses on a Friday and hands them to everyone on Monday. By Wednesday someone in sales has asked the assistant a question and got back a figure from a spreadsheet the finance lead thought was private. Nothing was hacked. The file had been shared with everyone in the organization two years earlier, in a month when sharing everything was the fastest way to work, and nobody had opened it since.

That is the shape of almost every Gemini Enterprise problem we get called about. The assistant did not break a permission. It read a permission that had been wrong for years and that no human was going to stumble across.

So before a client switches it on, we run five checks. They take days, not a quarter, and they decide whether you get an assistant people trust or one the leadership team quietly stops using.

## First, what Gemini Enterprise is on the invoice

It is a separate product with its own license, not a feature of your Workspace plan. Google's admin help is direct about this: Gemini Enterprise is not included with a Google Workspace subscription, so you buy licenses for it, directly or through a Google Cloud partner. Buy through a partner and adding seats later goes back through that partner, not through your own admin console.

Editions matter for a small company. Google's edition table puts the Business edition at 1 to 500 users with 25 GiB of pooled storage per user, Standard at 30 GiB and Plus at 75 GiB, with Plus aimed at teams building agents. For a 30-person firm, Business is usually the honest starting point, and the pooled storage line is the one most people miss when planning what to connect. We do not publish what the work around it costs; that lives in [how we work](https://guanacostech.com/how-we-work). The license is rarely the expensive part. The cleanup before it is.

## Check one: Gemini reads what the user reads

This is the whole access model. Google's help documentation states that Gemini has the same access to Workspace data as the user does: Drive files shared with them, calendar events they can view, and so on. It does not get a superuser view of the domain, and it does not hand anyone access to something they could not already open.

Which sounds reassuring until you turn it around. Every piece of over-broad sharing already sitting in your Drive is already a permission. What changes is the cost of finding it. A file shared with the whole company used to be effectively invisible unless somebody searched for the right phrase. Now there is a tool whose entire job is to search well, in plain language, for every licensed user.

So the question is not whether Gemini can be trusted with your data. It is whether your current sharing still describes who should see what. For most small businesses we look at, the answer is no, and has been for years.

## Check two: the sharing cleanup, and where the mess hides

You cannot review a whole Drive by hand. Two places give you the picture.

- **Drive log events** in the admin console, under Reporting, then Audit and investigation. It needs the Audit and Investigation administrator privilege. Results default to the last seven days, so widen or remove the date filter, combine attribute filters with AND and OR, and export the result somewhere you can sort it. Google notes most Drive audit events are logged only for files owned by users on supported editions, worth knowing before you read a thin report as good news.
- **The sharing defaults themselves**, in your Drive and Docs settings. Tightening a default stops new exposure. It does not reach back and close files that were already shared. The defaults and the cleanup are two separate jobs and both have to happen.

One honest limitation: an audit log tells you who did what, not who can open a given file right now. For current state you still have to look at the files, so we scope this by business risk: finance, HR, payroll, legal, anything holding customer records, and the shared drives that predate your current structure.

## Check three: agents do not inherit the polite default

This is the setting that surprises people, and the one we check first on any tenant that already has Gemini Enterprise switched on. Agent access to Workspace data has its own control, separate from the per-user model above. Google's admin help describes the default as allowing agents to request access to any Workspace data, with an admin option to block agents from Workspace data entirely. Turn that off and Gemini Enterprise features, agents included, cannot reach Workspace data at all.

Both ends of that are decisions, not accidents. Blocking agents makes the product much less useful. Leaving the default in place on a tenant whose sharing has never been audited is how you get the Wednesday phone call. We usually block agent access for the pilot, finish the sharing review, then open it up with the business owners in the room.

## If you are connecting Drive as a data source

Connecting Drive through the data store connector is a different path from the Workspace-side access above, with its own rules. Google's Cloud documentation says Gemini Enterprise does not copy your data into its index, so there is no second copy to manage. It also says access control depends on your identity provider, which you configure to enforce it, and that documents have to be reachable by the connector: in practice, living in a shared drive owned by the domain, or owned by a user in the domain. Personal Gmail accounts are not supported, because they have no Workspace customer ID.

For a small business that last point is the one that bites. Files owned by someone's personal account, or by a contractor who left two years ago, are often the ones that matter most and the least likely to be reachable. Fixing ownership belongs in the cleanup, not in a list for afterwards.

## Check four: data protection rules before, not after

If the sharing review is about what people can reach, data protection rules are about what leaves. You build these under Rules, then Create rule, then Data protection, and you need the View DLP rule and Manage DLP rule privileges. Conditions can use Google's predefined detectors for standard personal information, such as a taxpayer identification number, or custom detectors you write as a word list or a regular expression. Drive labels can serve as conditions too. Availability is tied to edition.

The feature we lean on hardest is the audit-only rule. It triggers and writes to the rule audit log and the investigation tool while taking no action, so you see what a rule would have caught before it blocks anything. Two weeks in audit-only mode is the cheapest way to learn what your staff actually send, and a better basis for a policy conversation than anybody's guess.

Custom detectors are where a small business gets value quickly, because the data you most need to protect is usually local: a national ID format, a client code, an invoice series.

## Check five: who gets a seat, and what you expect back

Turning the service on and assigning licenses are two different jobs, and doing them in the wrong order creates a support ticket.

Service status sits under Generative AI, then Gemini Enterprise, and changing it needs the Service Settings administrator privilege. You can set it on or off for everyone, or scope it to an organizational unit or a configuration group. Group settings override organizational units, and that is the mechanism we use for a pilot: leave the service off at the top of the tree, create a group, turn it on there. Google notes changes can take up to 24 hours, so do not schedule a demo for ten minutes after you flip the switch.

Licenses are assigned separately, under Directory, then Users, which needs the appropriate User management privilege. The matching service has to be on for the organization, or for the units and groups whose users will get licenses, before you assign them.

On who gets a seat: resist spreading licenses thinly across every department in the name of fairness. Pick the eight or ten people whose work is most obviously search and summarize, inside the same business function, so they compare notes with each other. A pilot spread across ten departments produces ten unconnected opinions and no decision.

## The go or no-go checklist

| Check | Where you look | What stops go-live |
| --- | --- | --- |
| License and edition | Your order, against the edition comparison | Seat count or pooled storage does not fit the tier you bought |
| Sharing hygiene | Drive log events, exported and sorted, plus the Drive sharing defaults | Finance, HR, payroll or client records still shared beyond their team |
| Agent data access | Generative AI, then Gemini Enterprise, agent access setting | Agents left on the default while the sharing review is unfinished |
| Data protection rules | `Rules`, then Data protection, running in audit-only mode | No rule covers the one data type your business cannot afford to leak |
| Seats and scope | Service status by group, then Directory, then Users | Service switched on for the whole domain instead of the pilot group |

## Measuring whether it earned the money

Pick two or three questions people in the pilot ask every week, and time them before you start. Where is the current version of this client's service agreement. What did we quote this customer last year. Summarize the last month of email on this project. If the assistant takes a 15-minute hunt down to two minutes for eight people, you have a number to set against the license cost. If nobody can name a task that got faster after a month, that usually means the information the assistant needed was never in Workspace.

Watch the other direction too. In the first month we read the Drive log events and the rule audit log for anything the pilot surfaced that it should not have. That is the fastest feedback you will get on the real quality of your sharing.

## How Guanacos Tech helps

We run this as a short engagement before the licenses get handed out: a sharing review scoped to the data that matters, agent access and data protection rules set deliberately rather than by default, a pilot group with a measurable list of questions, and a handover document your own admin can follow. The team holds Google certifications and works independently, in English and Spanish, across North America and Latin America. Our [Google Cloud consulting for small teams](https://guanacostech.com/google-cloud) page explains how we scope the work, and a 30-minute call is enough to tell you whether your tenant is ready or needs cleanup first.

## Sources

- [Turn Gemini Enterprise on or off for users (Google Workspace Admin Help)](https://knowledge.workspace.google.com/admin/generative-ai/gemini-enterprise/turn-gemini-enterprise-on-or-off-for-users)
- [Control access to Gemini Enterprise agents (Google Workspace Admin Help)](https://knowledge.workspace.google.com/admin/generative-ai/gemini-enterprise/control-access-to-gemini-enterprise-agents)
- [Add and assign Gemini Enterprise Business edition licenses to users](https://knowledge.workspace.google.com/admin/generative-ai/gemini-enterprise/assign-gemini-enterprise-business-edition-licenses-to-users)
- [Gemini Enterprise editions (Google Cloud documentation)](https://docs.cloud.google.com/agentspace/docs/editions)
- [Set up a Google Drive data store (Gemini Enterprise documentation)](https://docs.cloud.google.com/gemini/enterprise/docs/connectors/gdrive/set-up-data-store)
- [Getting started with DLP (Google Workspace Admin Help)](https://support.google.com/a/answer/9843931)
- [Drive log events (Google Workspace Admin Help)](https://support.google.com/a/answer/4579696)

## Frequently asked questions

### Is Gemini Enterprise included in my Google Workspace plan?

No. Google's admin help states that Gemini Enterprise is not included with a Google Workspace subscription, so you buy licenses separately, either directly or through a Google Cloud partner. If a partner sold them to you, adding more seats later goes through that partner.

### Can Gemini Enterprise see files a user was never given access to?

No. Google documents that Gemini has the same access to Workspace data as the user, so it reads Drive files shared with that person and calendar events they can view. The risk is old over-broad sharing becoming easy to find, not new access being created. Agent access to Workspace data is a separate admin setting.

### How do we pilot it with one team instead of the whole company?

Leave the service off at the organization level, create a configuration group for the pilot and turn it on for that group, because group settings override organizational units. Then assign licenses under Directory, then Users. Google notes the change can take up to 24 hours to apply.

---

Guanacos Tech is an independent consultancy with Google-certified engineers: email deliverability, Google Workspace and Google Cloud, in English and Spanish. Book a free 30-minute call: https://calendar.app.google/pq2seCCcch9U2GFV8